Cable testing and certification tools

Why this matters

This finishes objective 5.2 with the things you read off a device rather than measure with a meter: what the port status actually means, what the error counters distinguish, and the two failure families that produce the most confusing symptoms — power budget and transceiver mismatch.

The port status states in particular are worth learning precisely. "The port is down" has at least four distinct meanings here, and each points at a different cause.

The lesson

Port status, and what each state means

Administratively down. The port has been deliberately disabled by configuration. It is not a fault; somebody shut it down, possibly for good reason under the hardening lesson. The fix is to enable it, after finding out why it was disabled — a port shut down as part of a security response should not be casually re-enabled.

Down/down (protocol down, line down) means no physical signal. Cable, far-end device off, wrong port, failed transceiver.

Up/down — the line is up but the protocol is down — is the more interesting state: there is a physical signal but no working layer 2. Causes include an encapsulation or VLAN mismatch, a duplex problem, or the far end not completing negotiation.

Error disabled (err-disabled) means the switch shut the port down itself in response to a detected condition. This is a protection mechanism, not a failure, and the important step is to find out why rather than simply re-enabling it — the log message names the cause. Common triggers:

• Port security violation — an unauthorised MAC address appeared.
• BPDU Guard — a BPDU arrived on a port configured with PortFast, meaning a switch was plugged into an access port.
• Link flapping beyond a threshold.
• Duplex mismatch detected.

Clearing it requires shutting and re-enabling the port, or waiting for automatic recovery if configured — and fixing the underlying cause first, or it will simply happen again.

Suspended typically refers to a port in a link aggregation bundle that has been removed from the bundle because its configuration does not match the other members — different speed, duplex, VLAN or mode. The port is physically fine; it is excluded because including it would break the bundle. The fix is to make the configuration match.

The error counters

The counters from the previous lesson, with the distinctions the exam draws between them.

Cyclic redundancy check (CRC) errors mean the frame's checksum did not match what was calculated on arrival, so the frame was corrupted in transit. The CRC is the frame check sequence Ethernet appends at layer 2 — it detects errors and does not correct them, which is why recovery is TCP's problem at layer 4.

Rising CRC errors are the clearest single indicator of a physical-layer fault: cable, connector, interference, or a failing transceiver.

Runts are frames below the 64-byte Ethernet minimum. Causes are collisions, a duplex mismatch, or corruption truncating the frame.

Giants exceed the maximum frame size. Usually a misconfiguration — an MTU or jumbo-frame mismatch between devices — or, on a trunk, equipment that does not account for the extra 4 bytes of the 802.1Q tag.

Drops are frames the interface discarded deliberately, almost always because a queue was full. This is a congestion signal rather than a corruption one, and that distinction directs the fix: drops mean you need more capacity or QoS, whereas CRC errors mean you need a new cable. Confusing them sends you to replace hardware that is working perfectly.

Power over Ethernet

Power over Ethernet (PoE) delivers electrical power over the same twisted pair that carries data, powering access points, IP phones, cameras and sensors without a separate supply.

The standards, and the numbers are examinable:

Power available at the device is lower than at the port because of loss in the cable — roughly 12.95 W for 802.3af — which is why a device rated close to the limit can fail on a long run and work on a short one.

Power budget exceeded is the fault worth knowing. A switch has a total PoE budget shared across all its ports, and it is usually far less than the number of PoE ports multiplied by the per-port maximum. A 48-port switch may have a 370 W budget, which is nowhere near 48 × 30 W.

When the budget is exhausted, the switch stops powering additional devices — typically by priority, or simply refusing the next one to ask. The symptoms are distinctive and confusing:

• Devices that worked yesterday stop powering on after a new one is added.
• Devices boot and then reset, cycling, because they draw more once their radios or heaters start than they did at boot.
• The switch logs a power-budget message that nobody reads because they are looking at the device.

Diagnosis is to check the switch's PoE budget and allocation. Remedies: a higher-budget switch or redundant power supplies, a PoE injector for one hungry device, or moving devices to spread load.

Also check the standard: an 802.3bt camera on an 802.3af switch will not get the power it needs, and the failure looks like a faulty camera.

Transceivers, and their two named faults

Two named failures, both of which produce "the link will not come up" with no obvious cause.

Incorrect standard means the transceiver does not match what the link requires — a 1 Gb SFP where 10 Gb is needed, a short-reach optic on a long run, or a copper SFP where fibre is expected. It fits the cage, which is the problem: physical fit implies nothing about compatibility.

Mismatch covers the pairs that must agree end to end:

• Mode mismatch — a multimode optic on single-mode fibre or vice versa.
• Wavelength mismatch — two single-mode optics specified for different wavelengths cannot talk.
• Speed mismatch — a 10 Gb optic at one end and 1 Gb at the other.
• Vendor lock — the switch rejects a third-party module. The link is dead with no optical fault at all, and the log names the module rather than the fibre, which is the clue.

Signal strength is what distinguishes a transceiver fault from a fibre fault, and it is the most useful diagnostic here. Most optics support digital diagnostics, so the device can report transmit and receive optical power in dBm. Compare against the transceiver's specified range:

• Nothing transmitted — the local optic has failed.
• Transmitted but nothing received at the far end — the fibre path is broken, or the strands are crossed (the TX/RX transposition from the previous lesson).
• Received power below the sensitivity threshold — too much loss: excessive distance, dirty connectors, too many patch points, or a tight bend.
• Received power above the maximum — the optic is overdriven, which happens with a long-reach optic on a very short link. The fix is an attenuator, and the symptom is errors rather than a dead link.

That reading turns "the fibre link is down" from a guess into a measurement, and it is the fastest way to decide whether to clean, re-terminate, replace the optic or chase the cable.